Overview

overview

10

Static

static

8

compta_breizh (1).xls

windows7-x64

10

compta_breizh (1).xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    compta_breizh (1).xls

  • Size

    580KB

  • Sample

    230329-r1jp3sgg32

  • MD5

    1149360d266ca100ff6a7ce2a8414d53

  • SHA1

    ff87dbe2730be9fb594a337e857b5f5c235e2005

  • SHA256

    27a6ab7e03075bcc4873b52d67d83d2e61067282c8d4376d8a1778eda385b68a

  • SHA512

    e885178f839dfbc5e7fc4012bce4a5d646d4c287841a76bf19fbdb51cc688cb3c51a724ffdfab0269f628d5364a6a1680284b9bb3f63e049f44132168f2e76e9

  • SSDEEP

    6144:Ik3hbdlylKsgqopeJBWhZFVEUr3M/sItOd/AIIuY3/RsxRIA2e6FngrNv8zKCq/i:jY3ecALrquDK

Score
10/10
macromacro_on_action

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://transfer.sh/get

Targets

    • Target

      compta_breizh (1).xls

    • Size

      580KB

    • MD5

      1149360d266ca100ff6a7ce2a8414d53

    • SHA1

      ff87dbe2730be9fb594a337e857b5f5c235e2005

    • SHA256

      27a6ab7e03075bcc4873b52d67d83d2e61067282c8d4376d8a1778eda385b68a

    • SHA512

      e885178f839dfbc5e7fc4012bce4a5d646d4c287841a76bf19fbdb51cc688cb3c51a724ffdfab0269f628d5364a6a1680284b9bb3f63e049f44132168f2e76e9

    • SSDEEP

      6144:Ik3hbdlylKsgqopeJBWhZFVEUr3M/sItOd/AIIuY3/RsxRIA2e6FngrNv8zKCq/i:jY3ecALrquDK

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks